Wildcards on FILE_OBJECT filename

NTFSD
1

Hi again,

A different topic. On the PreCreateOp, I receive this objects:

TargetFileObject’s filename: “*\myfile.txt”

TargetFileObject->RelatedFileObject->Filename: "\Device\HarddiskVolume2"

The call to FltGetFileNameInformation resolves to “\Device\HarddiskVolume2*\myfile.txt”

It is generated issuing a COPY \myfile.txt . on Windows 10. I think the generated filename is incorrect (passing normalized or opened flag).

In FastFat sample I couldn’t figure out any special treatement for wildcards on create path.

What is it supposed I must do in this scenario? Ignore the * at the beginnig?

2

Actually in the FastFat code you will see where it returns
STATUS_OBJECT_NAME_INVALID if it processes a component that contains a
wild card. See where it calls FatIsNameShortEomValid() passing in a
FALSE to indicate wild cards are not admissable.

Pete

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com http:</http:>
866.263.9295

------ Original Message ------
From: xxxxx@mauroleggieri.com.ar
To: “Windows File Systems Devs Interest List”
Sent: 2/3/2016 11:03:37 AM
Subject: [ntfsd] Wildcards on FILE_OBJECT filename

>Hi again,
>
>A different topic. On the PreCreateOp, I receive this objects:
>
>TargetFileObject’s filename: “*\myfile.txt”
>
>TargetFileObject->RelatedFileObject->Filename:
>“\Device\HarddiskVolume2"
>
>The call to FltGetFileNameInformation resolves to
>”\Device\HarddiskVolume2*\myfile.txt"
>
>It is generated issuing a COPY \myfile.txt . on Windows 10. I think the
>generated filename is incorrect (passing normalized or opened flag).
>
>In FastFat sample I couldn’t figure out any special treatement for
>wildcards on create path.
>
>What is it supposed I must do in this scenario? Ignore the * at the
>beginnig?
>
>
>
>—
>NTFSD is sponsored by OSR
>
>
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>software drivers!
>Details at http:
>
>To unsubscribe, visit the List Server section of OSR Online at
>http:</http:></http:>

3

Thanks Pete. Because I didn’t see a new create operation with a different name, it caught my attention.

4

Some file systems do permit wildcards in the name. For example, NTFS in POSIX mode. MSFS (mailslots) also use wildcards (“*”) to indicate multiple targets.

I’ve noticed that Explorer will attempt to open * and then when it fails open the directory and enumerate it. Of course, that was many years ago and I haven’t looked recently - applications do strange things.

Tony
OSR

5

Hahaha yes Tony. One assumes Explorer or, in my case CMD, will pass correct parameters and not weird ones :slight_smile: